msm: ais: smmu: Use get_file to increase ref count
Due to race condition, fd pointing to a particular dma buf is released by userspace before incrementing ref count and hence freed that dma buf. When the call returns it still uses the freed dma buf causing use-after-free. This fix includes get_file API to increment ref count before dma_buf_fd. CRs-Fixed: 3341070 Change-Id: Iede8f2fa21da43318e9085289aacf946418b53b7 Signed-off-by:Shivakumar Malke <quic_smalke@quicinc.com> Signed-off-by:
Ramaprasad Nagaraj <quic_ramapras@quicinc.com>
Loading
Please register or sign in to comment